Skip to content
Heist/ feed
Back to feed
Unrated

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

Type: advisorySources: Official CVE List

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-115825
Confirmed fixed CVEs
Not specified
Updated in this feed
29 Oct 2026, 07:55 UTC · Revision 1

Source evidence

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length

core-cve · Original source

Published 25 Oct 2026, 16:51 UTC

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.

cve:CVE-2026-115825
Complete source record
{
  "id": "fb171e1789267305c7d861907818bfc44e93bc055ac1051f21cb17c2447606f3",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-115825",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length",
    "summary": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares. A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.",
    "evidence": "cve:CVE-2026-115825",
    "products": [],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-115825",
      "aliases": [
        "CVE-2026-115825"
      ],
      "metrics": [],
      "affected": [
        {
          "repo": "https://github.com/plack/Plack",
          "modules": [
            "HTTP::Server::PSGI"
          ],
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.0056",
              "versionType": "custom"
            }
          ],
          "packageURL": "pkg:cpan/Plack",
          "packageName": "Plack",
          "programFiles": [
            "lib/HTTP/Server/PSGI.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "HTTP::Server::PSGI::handle_connection"
            }
          ]
        }
      ],
      "modified": "2026-10-26T01:23:53.588Z",
      "provider": "cve",
      "references": [
        "https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch",
        "https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes"
      ],
      "provider_metadata": {
        "adp": [
          {
            "title": "CVE Program Container",
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/10/26/10"
              }
            ],
            "providerMetadata": {
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE",
              "dateUpdated": "2026-10-26T01:23:53.588Z"
            }
          }
        ],
        "cna": {
          "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
          "shortName": "CPANSec",
          "dateUpdated": "2026-10-25T16:51:54.897Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-115825",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-cve",
  "document_id": 231509,
  "published_at": "2026-10-25T16:51:54.897+00:00"
}